VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/gomarkdown/markdown: vulnerability history, versions and safety

github.com/gomarkdown/markdown is a package in the Go ecosystem. Vulert records 7 vulnerabilities for it across 120 releases, from Sep 2023 to Oct 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
7 vulnerabilities recorded H3 M1 U3
i
0 with no fix published

Every vulnerability has a patched version to move to.

i
3 in the last 12 months

Most recent disclosure 16 Oct 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/gomarkdown/markdown vulnerabilities

Vulert verdict on github.com/gomarkdown/markdown v0.0.0-20261022144421-6c848fa1b723 i

Updated on 23 Oct 2026

Action needed: v0.0.0-20261022144421-6c848fa1b723 has 7 known vulnerabilities, but every one of them has a fix. Upgrade to the version listed below and you are clear.

Package health score 71/100
  • Security Some issues to review
  • Maintenance Sustainable
  • Popularity Widely used
  • Community Quiet

What to do: Upgrade to the version that resolves each vulnerability below. Fix it, then keep watch: this version is affected today, and the next one may be too — Vulert alerts you when a new vulnerability lands. Monitor it with Vulert →

  • Current release v0.0.0-20261022144421-6c848fa1b723 — affected i
  • Vulnerabilities on record 7 over 3 years · 3 in the last year i
  • Latest disclosure 16 Oct 2026 i
  • Highest CVSS 7.5 i
  • With no published fix 0 i
  • Stars 1,738 i
  • OpenSSF scorecard 3/10 i
  • Last release this month i
  • Licence BSD-2-Clause i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/gomarkdown/markdown, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v0.0.0-20261022144421-6c848fa1b723 22 Oct 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20261011113952-f83953680332 11 Oct 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20261011112615-a0dcbc43779a 11 Oct 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20261006233006-5e92716d526e 06 Oct 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20261006014541-eb0281f1d676 06 Oct 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20261006012502-18c3b5f0f56a 06 Oct 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260923180740-94fc73f6b1a3 23 Sep 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260923164715-06faf786ee2b 23 Sep 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260921172736-e177decc3c2f 21 Sep 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260917010721-cc30ffac3c05 17 Sep 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260916235943-d5e93c6037b1 16 Sep 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260916113448-ad2c8ed2781a 16 Sep 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260916112841-d262dc9f7970 16 Sep 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260916112545-17b8dcafd2da 16 Sep 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260916112455-f656d5236c9d 16 Sep 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260916112404-781c5ebe0fda 16 Sep 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260916112056-78fd43063199 16 Sep 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260916105230-0fffec99bea1 16 Sep 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260916102013-afab853b9418 16 Sep 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260916101420-f7850431d777 16 Sep 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260914122325-add8e0bd8ae0 14 Sep 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260914122201-df60b3d98c07 14 Sep 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260914104108-d0b5ea06ca81 14 Sep 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260907091611-16791ada75cf 07 Sep 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260824154242-13c5cf49db8d 24 Aug 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260824153813-68d65c83b9bf 24 Aug 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260824153512-d18ffa2a4707 24 Aug 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260824151336-45814d58469f 24 Aug 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260824141706-406f14e4c2da 24 Aug 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260824140814-dee3afa976f5 24 Aug 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260824124553-113a3a2bcce7 24 Aug 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260824121159-eaebe1cbcfc5 24 Aug 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260824111214-a79957697d45 24 Aug 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260824110319-7e841db23ddc 24 Aug 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260818103853-6d1f24fc3a11 18 Aug 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260725000948-8435af3f5984 25 Jul 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260725000432-8f94351c8746 25 Jul 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260724235538-61af6e1e6971 24 Jul 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260614204949-e08cff860f76 14 Jun 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260614153850-4ebefe1a0ab1 14 Jun 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260614152104-7a011165356e 14 Jun 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260614151725-319d05a02389 14 Jun 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260614150055-08bb5b5ed4c0 14 Jun 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260614145735-ceb4b55ffdaa 14 Jun 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260614145413-8aa941ad1d5c 14 Jun 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260614145227-cbb47150e755 14 Jun 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260614145152-a86bef8a9621 14 Jun 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260614145113-66e0feeb710f 14 Jun 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260614145034-7cf4ae12ab81 14 Jun 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260614144938-ee4b6d0f11ac 14 Jun 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260614144834-34397a3c6386 14 Jun 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260614144640-24dbc0efe1d6 14 Jun 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260614131822-49dadc64d17b 14 Jun 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260614131405-84cfb9f02eda 14 Jun 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260417124207-7d523f7318df 17 Apr 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260412113850-134a5b2cce7f 12 Apr 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260412113850-eee56fa8d5dd 12 Apr 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260411013819-759bbc3e3207 11 Apr 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260217112301-37c66b85d6ab 17 Feb 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260217112137-9458c5ebcea7 17 Feb 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260217091458-c901e061be45 17 Feb 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260217091342-a0dc97ab6b56 17 Feb 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20260217091221-554ac1d98ec4 17 Feb 2026 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20250810172220-2e2c11897d1a 10 Aug 2025 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20250810172220-2e3133137e1d 10 Aug 2025 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20250731182530-5d03d1963446 31 Jul 2025 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20250731182530-6f5c8ffd56bf 31 Jul 2025 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20250731182530-e08794994d93 31 Jul 2025 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20250311123330-531bef5e742b 11 Mar 2025 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20250207164621-7a1f277a159e 07 Feb 2025 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20250202022148-4f606c78d442 02 Feb 2025 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20250202022148-fe0b4be2f24a 02 Feb 2025 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20250111211300-c986ce934cac 11 Jan 2025 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20241205020045-f7e15b2f3e62 05 Dec 2024 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20241204215513-7786913245e6 04 Dec 2024 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20241204183237-865e83d2b7c9 04 Dec 2024 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20241204151404-87d094f40b92 04 Dec 2024 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20241105142532-d03b89096d81 05 Nov 2024 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20241102151059-6bc1ffdc6e8c 02 Nov 2024 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20240930133441-72d49d9543d8 30 Sep 2024 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20240930133403-7e0a027d98c5 30 Sep 2024 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20240730141124-034f12af3bf6 30 Jul 2024 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20240730132007-0acb1f16a436 30 Jul 2024 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20240730131326-880ee61d5f68 30 Jul 2024 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20240729215908-77f4768f716d 29 Jul 2024 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20240729212818-a2a9c4f76ef5 29 Jul 2024 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20240723152757-afa4a469d4f9 23 Jul 2024 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20240626202925-2eda941fd024 26 Jun 2024 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20240625204355-a4f7c57820cb 25 Jun 2024 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20240419095408-642f0ee99ae2 19 Apr 2024 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20240328165702-4d01890c35c0 28 Mar 2024 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20240328164714-8d53b2548579 28 Mar 2024 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20240328155451-1d8abb74ad09 28 Mar 2024 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20231222211730-1d6d20845b47 22 Dec 2023 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20231222211730-282af34befba 22 Dec 2023 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20231115200524-a660076da3fd 15 Nov 2023 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20230922112808-5421fefb8386 22 Sep 2023 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20230922105210-14b16010c2ee 22 Sep 2023 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20230916125811-7478c230c7cd 16 Sep 2023 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20230912175223-14b07df9d538 12 Sep 2023 H3 M1 U3 BSD-2-Clause Yes Details →
v0.0.0-20230716120725-531d2d74bc12 16 Jul 2023 H3 M1 U3 — Yes Details →
v0.0.0-20230715013231-4ef5a8cbdbf1 15 Jul 2023 H3 M1 U3 — Yes Details →
v0.0.0-20230715013231-5c5aace26ebc 15 Jul 2023 H3 M1 U3 — Yes Details →
v0.0.0-20230715013231-a46a3be917c7 15 Jul 2023 H3 M1 U3 — Yes Details →
v0.0.0-20230715013231-caa939125d99 15 Jul 2023 H3 M1 U3 — Yes Details →
v0.0.0-20230714230225-84ecad09a30a 14 Jul 2023 H3 M1 U3 — Yes Details →
v0.0.0-20230711084535-11b03c0ae6d6 11 Jul 2023 H3 M1 U3 — Yes Details →
v0.0.0-20230322041520-c84983bdbf2a 22 Mar 2023 H3 M1 U3 — Yes Details →
v0.0.0-20230322041133-cdc749a5e8df 22 Mar 2023 H3 M1 U3 — Yes Details →
v0.0.0-20230322040809-4646a310e35f 22 Mar 2023 H3 M1 U3 — Yes Details →
v0.0.0-20230322035321-5f17e2f50624 22 Mar 2023 H3 M1 U3 — Yes Details →
v0.0.0-20230321061146-9af27b67c68e 21 Mar 2023 H3 M1 U3 — Yes Details →
v0.0.0-20230321061043-e8131e1babbc 21 Mar 2023 H3 M1 U3 — Yes Details →
v0.0.0-20230321061005-c64575b29b5d 21 Mar 2023 H3 M1 U3 — Yes Details →
v0.0.0-20230321044648-154b583bceb3 21 Mar 2023 H3 M1 U3 — Yes Details →
v0.0.0-20230313173142-2ced44d5b584 13 Mar 2023 H3 M1 U3 — Yes Details →
v0.0.0-20230312215031-f439dd2b4436 12 Mar 2023 H3 M1 U3 — Yes Details →
v0.0.0-20230312174038-279c45774906 12 Mar 2023 H3 M1 U3 — Yes Details →
v0.0.0-20230312001534-ae1a42e38ef1 12 Mar 2023 H3 M1 U3 — Yes Details →
v0.0.0-20230312001122-f53f7ba35b50 12 Mar 2023 H3 M1 U3 — Yes Details →

The newest 120 of 508 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2023 2
  • 2024 2
  • 2026 3

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 3 of the 7 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/gomarkdown/markdown

The 5 most severe of 7 vulnerabilities recorded for this package

Search all 7 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2023-42821: Out-of-Bounds Read Vulnerability in github.com/gomarkdown/markdown 7.5 high 0.0.0-20230922105210-14b16010c2ee 22 Sep 2023
Out-of-bounds Read Vulnerability in Go Markdown's SmartypantsRenderer 7.5 high 0.0.0-20260411013819-759bbc3e3207 14 Apr 2026
CVE-2026-102941: gomarkdown/markdown - IsSafeURL Function Panics on Short URLs 7.5 high 0.0.0-20260724235538-61af6e1e6971 16 Oct 2026
CVE-2024-44337: Infinite Loop Vulnerability in github.com/gomarkdown/markdown 5.1 medium 0.0.0-20240729212818-a2a9c4f76ef5 15 Oct 2024
CVE-2023-42821: Out-of-Bounds Read Vulnerability in github.com/gomarkdown/markdown N/A unrated 0.0.0-20230922105210-14b16010c2ee 22 Sep 2023

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/gomarkdown/markdown

Is github.com/gomarkdown/markdown safe to use?

Vulert records 7 vulnerabilities for github.com/gomarkdown/markdown in Go: 0 critical, 3 high, 1 medium and 0 low, plus 3 not yet rated. Every one of them has a published fix, so the practical answer is to run a supported release and keep it patched.

What is github.com/gomarkdown/markdown's Vulert package health score?

Vulert scores github.com/gomarkdown/markdown 71/100, which reads as in good shape. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15).

Is the latest version of github.com/gomarkdown/markdown affected?

Yes. v0.0.0-20261022144421-6c848fa1b723, the version you would install today, has 7 known vulnerabilities, and every one of them has a published fix. Upgrade to the version listed for each.

How many vulnerabilities does github.com/gomarkdown/markdown have?

7 vulnerabilities are recorded for github.com/gomarkdown/markdown in the Go ecosystem: 0 critical, 3 high, 1 medium and 0 low, plus 3 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/gomarkdown/markdown vulnerabilities disclosed?

3 vulnerabilities were recorded for github.com/gomarkdown/markdown in the last 12 months, and the oldest entry in this database dates to 22 Sep 2023. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/gomarkdown/markdown are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/gomarkdown/markdown for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/gomarkdown/markdown version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.